Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is now in Linus' tree

lists.zx2c4.com

Post reply on HN
Print view View original

281–290 of 293 posts

Re: WireGuard is now in Linus' tree

#281

Post by hevisko »

numbsafari wrote: post #59

As someone who regularly deals with IPSec in conservative network environments, Wireguard can’t gain broad adoption soon enough, in my opinion. Now that it’s merged into Linus’s tree, any word on it getting an official release and the “this isn’t production ready, so no CVEs” disclaimer going away? EDIT: Further back in the thread, Donenfeld says “Please note that until Linux 5.6 is released, this snapshot is a snaps…

Until Cisco (as well as Juniper/AltoPalo/FortiNet/CheckPoint/etc.) implements WG, IPsec will stay with us ;(

I can't deploy WG before that haven't happened... thus time to get WG into RFCs!!!

Re: WireGuard is now in Linus' tree

#282

Post by pferde »

muldvarp wrote: post #224
pferde wrote: post #148

Earlier quoted context omitted.

I'm a big fan of Wireguard, and am using it in a few places, but OpenVPN still has its place - namely if you need a VPN tunnel from behind a firewall that only allows outgoing connections to small number of TCP ports, and no UDP ports.

You're not wrong. OpenVPN can be useful in that case, but in general you shouldn't use TCP as the underlying protocol for other TCP traffic, if you can avoid it. The better solution in this case would be to open a UDP port in the firewall.

My entire point was that in this case, I can not avoid it, it is my only option. Beggars can't be choosers and all that.

Re: WireGuard is now in Linus' tree

#283

Post by monkeybutt »

kevin_nisbet wrote: post #233
adevx wrote: post #176

Earlier quoted context omitted.

In my case yes and yes, but mostly because I spread out over two cloud providers.

But it only needs to be accessible on the port WireGuard uses for communications, and WireGuard also has a nice property where it acts passively for non-wireguard packets. So someone on the internet doesn't necessarily know the node is reachable from the internet if they try and scan it for example. Edit: IIRC only one end of the connection needs a stable endpoint as well. IIRC WireGuard supports mobility (changing I…

afaik, both ends can move, they just send packets to the latest IP they received a valid packet from.

Re: WireGuard is now in Linus' tree

#284

Post by throw0101a »

mjevans wrote: post #260
throw0101a wrote: post #203

Earlier quoted context omitted.

> As someone who regularly deals with IPSec in conservative network environments, Wireguard can’t gain broad adoption soon enough, in my opinion. As someone who does not do heavy NetOps, can you speak more about what's wrong with IPsec?

The over-summarized version is: IPSec is extensible and it's rather tedious to get every implementation to interoperate securely with every other implementation simultaneously (and in the correctly secure way). While using IPSec between supported devices, in an ideally configured setup, yield slight but real benefits with respect to attack resistance, a practical comparison of the difficulty involved and possible con…

Well, the main advantage of WireGuard then seems to be it doesn't give you any options, so you're less likely to mess it up. Of course there is only one (two?) implementation(s) of it, so "interoperability" as such is not really a thing.

IPsec can be/is complicated because we learnt as we went with it, but given the correct settings, it can be/is secure.

So just like with SSL/TLS, it may be necessary to 'simply' introduce new RFCs to deprecate the Bad Way(s) of configuring it. Doing a quick search, there's a BCP RFC:

* https://tools.ietf.org/html/rfc5406

(I haven't really used either, so am just spit-balling here.)

Re: WireGuard is now in Linus' tree

#285

Post by croon »

andrewnicolalde wrote: post #111
SkyPuncher wrote: post #85

Earlier quoted context omitted.

I setup WireGuard on my Ubiquiti router and have profiles installed on my phone and Mac. Extremely convenient for some basic privacy when on a public hotspot.

Nice! Is it one of the UniFi ones?

Have not tried this myself [1]; But I do have a USG, so I might when I have the time.

[1] https://graham.hayes.ie/posts/wireguard-%2B-unifi/

Re: WireGuard is now in Linus' tree

#286

Post by [deleted] »

3xblah wrote: post #275
plapetomain wrote: post #263

Earlier quoted context omitted.

Yes, pretty much since most ISPs do not block UDP port 53. I have no reason to run DNS on a home internet connection. What would a sane use case be? They don’t block it because it would be stupid to use it anyway. Ports that are typically blocked include 67, 139, 161, 520, 547, etc.. ie dhcp, rip, smb, snmp... none of them are any great loss to those that want to run a vpn. Running a VPN or ssh service is another sto…

As someone else pointed out, the issue is mainly NAT not necessarily just "blocked" ports. What works with your ISP may not work with someone else's.

[deleted]

Re: WireGuard is now in Linus' tree

#287

Post by whatsdoom »

adevx wrote: post #150

Fantastic news. I deploy WireGuard to provide a private network (mesh) between VPS servers. Each VPS instance has each other vps as peer. So no single source of failure. I run PostgreSQL with Patroni and GlusterFS over this mesh with no issues. When I add or destroy a VPS with Ansible all VPS nodes get an updated config and reload. This way I don't rely on a single cloud provider because I do not use their private ne…

Did you follow a particular tutorial or do you have any resources you'd recommend to help replicate this setup?

I've been interested in setting up a private network similar to what you describe and your comment has piqued my interest in finally building it

Re: WireGuard is now in Linus' tree

#288

Post by ahmedalsudani »

lern_too_spel wrote: post #103
ahmedalsudani wrote: post #23

Earlier quoted context omitted.

I don’t know what PPS is, but that is an inaccurate sentiment. Running as a kernel module allows you to achieve higher throughout and lower latency.

You're correct. I don't know why you're downvoted. Anything you can do to get performance with kernel bypass techniques can be done inside the kernel as well.

¯\_(ツ)_/¯ It’s alright. You sometimes get downvoted by the early two people who are offended that I’d dare comment without knowing what PPS is (or something equally offensive).

Re: WireGuard is now in Linus' tree

#289

Post by adevx »

whatsdoom wrote: post #287
adevx wrote: post #150

Fantastic news. I deploy WireGuard to provide a private network (mesh) between VPS servers. Each VPS instance has each other vps as peer. So no single source of failure. I run PostgreSQL with Patroni and GlusterFS over this mesh with no issues. When I add or destroy a VPS with Ansible all VPS nodes get an updated config and reload. This way I don't rely on a single cloud provider because I do not use their private ne…

Did you follow a particular tutorial or do you have any resources you'd recommend to help replicate this setup? I've been interested in setting up a private network similar to what you describe and your comment has piqued my interest in finally building it

I'm considering writing a blog post about it as I documented most steps. Plus having everything in Ansible is more or less a guide / tutorial in itself.

Re: WireGuard is now in Linus' tree

#290

Post by api »

adevx wrote: post #250
PhilippGille wrote: post #223

Earlier quoted context omitted.

I thought about doing something similar, but with Slack's Nebula or with ZeroTier (v2, which is not released yet). They're specifically designed for this kind of overlay network if I'm not mistaken, taking care of node additions and removals automatically. Nebula with fixed "lighthouses", ZeroTier with a decentralized KV store. Did you look into these as alternatives? https://github.com/slackhq/nebula https://www.zer…

Didn't know about nebula, definitely interesting. I looked into ZeroTier but I believe it has a central control server for connection initiation, and I read some comments about slow connections if I remember correctly.

OP is referring to ZeroTier 2.x which makes it easier to run your own control servers (called root servers in ZT).

Any connection flakiness is probably due to NAT or firewall issues and is going to occur in any P2P network layer since they all use a toolbox of common techniques such as UDP hole punching.

Post reply on HN